User-Based Security¶
Turn on MetaMiner Security so every MetaMiner Client connection needs a MetaMiner user name and password, and turn on Power BI SSO so each user also signs in to Microsoft and sees only their own workspaces.
When MetaMiner Security is off, any MetaMiner Client that can reach the server connects without a password and has full access. Turn it on for every production installation.
Before you begin¶
- Run the MetaMiner Administrator (MMA) on the MetaMiner Server host as a Windows administrator.
- Create at least one MetaMiner user with the Administrator role in every environment, so you can still connect after you turn security on. See Users and Roles.
- Decide the role each user gets in each environment. A user without a role gets No Access.
- For Power BI SSO: your Microsoft administrators have consented to the MetaMiner sign-in app. See Delegated User Sign-In.
- Optional: configure e-mail and turn on Notify on any MM security changes in Preferences > Settings... > Notifications, so administrators are told when security is turned on or off.
Steps¶
Turn on MetaMiner Security¶
-
In MMA, open the Security menu.
Image of the MMA Security menu with Encrypt Config..., Enable MetaMiner Security (checked), Enable Power BI SSO, Define Users... and Define Roles...
../images/security/mma-security-menu.png -
Click Define Users... and check that each user has the right role in each environment column.
- Open the Security menu again and click Enable MetaMiner Security. A check mark shows that security is on. MMA saves the change at once.
- Ask users to reconnect. The MetaMiner Client now asks for a MetaMiner user name and password.
To turn security off, click Enable MetaMiner Security again to clear the check mark.
Turning security off
With security off, any client that reaches the MetaMiner Server port connects with full access. Turn security off only for short maintenance windows.
Turn on Power BI SSO¶
- In MMA, open the Security menu and click Enable Power BI SSO. A check mark shows that it is on.
- Ask users to reconnect. When they apply their environment selection, the MetaMiner Client asks each user to sign in to Microsoft for each Power BI environment.
- Each user sees only the workspaces their Microsoft account can access in the Power BI Explorer.
| Sign-in method | When it is used | What the user sees |
|---|---|---|
| Microsoft interactive sign-in (default) | pbi.interactive.login.enabled is true, the default |
The Power BI sign-in dialog with Sign in with Microsoft, which opens the Microsoft sign-in page in the browser |
| User name and password | pbi.interactive.login.enabled is set to false |
The Enter Power BI SSO Credentials dialog |
pbi.interactive.login.enabled is read from MetaMinerServer.properties in the server folder. Keep the interactive method. It applies your Conditional Access and multifactor policies, and MetaMiner never sees the Microsoft password.
What Power BI SSO enables
Power BI SSO is required for Manage Workspace Access and for the Tenant Admin View. Users with Tenant Admin can switch to that view to see every workspace.
What changes when security is on¶
| Area | With MetaMiner Security on |
|---|---|
| MetaMiner Client connection | Needs a MetaMiner user name and password |
| Tabs and actions | Shown and allowed according to the user's role in each environment |
| Server requests | The server checks the permission for each protected request |
| Environments | An environment where the user has No Access is not available to that user |
| Password policy | The rules in Preferences > Settings... > General apply to MetaMiner users |
| Meta Query on the web | Sign-in with MetaMiner users is available |
| Area | With Power BI SSO on |
|---|---|
| Connect | Each user signs in to Microsoft for each Power BI environment |
| Power BI Explorer | Shows only the workspaces the user's Microsoft account can access |
| Manage Workspace Access, Tenant Admin View | Available, subject to permissions and Microsoft roles |
Password policy¶
Set these in Preferences > Settings... > General. They apply to MetaMiner users, not to LDAP or AD users.
| Setting | Default | Effect |
|---|---|---|
| Min password length | 4 | Minimum length of a new password |
| Enforce Password Complexity | Off | New passwords need a digit, an upper case letter, a lower case letter and a special character |
| Password expiration (days) | No expiry | Users must change the password after this many days |
| Login failure threshold | 3 | Failed sign-ins before the user is blocked |
| User Inactive threshold | 90 | Days without sign-in after which the user is disabled |
MetaMiner also rejects a new password that repeats one of the last passwords in the user's history, and allows one password change per day.
Image of Preferences > Settings > General with the Password Restrictions group filled in
../images/security/mma-settings-password-restrictions.png
When a user is blocked by the failure threshold, open the user in Define Users... and click Reset next to Failed Attempts. If e-mail is configured, MetaMiner sends a notification when a user is blocked.
Verify¶
- Start the MetaMiner Client and connect. The client asks for a user name and password.
- With Power BI SSO on, the client asks you to sign in to Microsoft before loading the Power BI environment.
- Sign in as a user with Read Only. Tabs and actions that need other permissions are hidden.
- Sign in with a wrong MetaMiner password. The client refuses the connection.
Troubleshooting¶
An environment is missing in the MetaMiner Client
The user has No Access in that environment. Assign a role in Define Users.... MMA also warns when no user has a role other than No Access for an environment.
A user is locked out
Open the user in Define Users..., click Reset next to Failed Attempts, and clear Disabled if it is set.
Nobody can connect after turning security on
Turn security off in MMA, create a user with the Administrator role, assign it to every environment, then turn security on again.
Microsoft sign-in shows Need admin approval
Your Microsoft administrators have not consented to the MetaMiner sign-in app for your organization. See Delegated User Sign-In.
A user sees fewer workspaces than expected
With Power BI SSO on, the explorer shows only workspaces the user's Microsoft account can access. Check the user's workspace roles in Power BI. Tenant administrators can use the Tenant Admin View.